CVE-2026-39430

Quick assessment

Affected

n/a n/a

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 HP Poly EagleEye Cube USB 1.3.1-001267 设备上，管理员身份验证流程存在缺陷：设备端未实施会话管理和访问控制。因此，未认证用户可通过修改后的客户端（绕过登录步骤）或自定义客户端直接调用底层管理员 API，在未登录的情况下更改管理员级别设置。这使未认证用户能够执行各类管理操作，例如导出包含管理员用户内部设备凭证及其他网络系统凭证的配置文件。

AI Predicted 9.8 Difficulty: Easy Updated Nov 04, 2026

Possible ATT&CK Techniques 3 AI

T1078 · Valid Accounts T1003 · OS Credential Dumping T1190 · Exploit Public-Facing Application

Updated Nov 04, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls are not enforced device-side. Thus, an unauthenticated user can change administrator-level settings (without logging in) via a modified client that bypasses the login step or via a custom client to make the underlying administrator API calls. This allows unauthenticated users to perform administrative actions too such as exporting configuration files that include the internal device credentials for the administrator user and other network systems.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	n/a	n/a	-

II. Public POCs for CVE-2026-39430

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-39430

请登录查看更多情报信息。

Other References for CVE-2026-39430 (3)

https://www.cve.org/CVERecord?id=CVE-2026-39430

Same Patch Batch · n/a · 2026-11-04 · 3 CVEs total

CVE-2026-121610	7.3 HIGH	funadmin Frontend List Endpoint index selectList sql injection
CVE-2026-39431		HP Poly EagleEye Cube 1.3.1-001267 命令注入漏洞

IV. Related Vulnerabilities

Same product: n/a

Same vendor: n/a